Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-4329

Publication date:

29/10/2019

IBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 161209.

Severity CVSS v4.0: Pending analysis

Last modification:

01/01/2022

CVE-2019-4546

Publication date:

29/10/2019

After installing the IBM Maximo Health- Safety and Environment Manager 7.6.1, a user is granted additional privileges that they are not normally allowed to access. IBM X-Force ID: 165948.

Severity CVSS v4.0: Pending analysis

Last modification:

30/10/2019

CVE-2019-4600

Publication date:

29/10/2019

IBM API Connect version V5.0.0.0 through 5.0.8.7 could reveal sensitive information to an attacker using a specially crafted HTTP request. IBM X-Force ID: 167883.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2019-4306

Publication date:

29/10/2019

IBM Security Guardium Big Data Intelligence (SonarG) 4.0 specifies permissions for a security-critical resource which could lead to the exposure of sensitive information or the modification of that resource by unintended parties. IBM X-Force ID: 160986.

Severity CVSS v4.0: Pending analysis

Last modification:

03/02/2023

CVE-2019-18188

Publication date:

28/10/2019

Trend Micro Apex One could be exploited by an attacker utilizing a command injection vulnerability to extract files from an arbitrary zip file to a specific folder on the Apex One server, which could potentially lead to remote code execution (RCE). The remote process execution is bound to the IUSR account, which has restricted permission and is unable to make major system changes. An attempted attack requires user authentication.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2019-18189

Publication date:

28/10/2019

A directory traversal vulnerability in Trend Micro Apex One, OfficeScan (11.0, XG) and Worry-Free Business Security (9.5, 10.0) may allow an attacker to bypass authentication and log on to an affected product&#39;s management console as a root user. The vulnerability does not require authentication.

Severity CVSS v4.0: Pending analysis

Last modification:

05/11/2019

CVE-2019-18187

Publication date:

28/10/2019

Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution (RCE). The remote process execution is bound to a web service account, which depending on the web platform used may have restricted permissions. An attempted attack requires user authentication.

Severity CVSS v4.0: Pending analysis

Last modification:

30/10/2025

CVE-2017-15725

Publication date:

28/10/2019

An XML External Entity Injection vulnerability exists in Dzone AnswerHub.

Severity CVSS v4.0: Pending analysis

Last modification:

31/10/2019

CVE-2012-5577

Publication date:

28/10/2019

Python keyring lib before 0.10 created keyring files with world-readable permissions.

Severity CVSS v4.0: Pending analysis

Last modification:

31/10/2019

CVE-2019-14450

Publication date:

28/10/2019

A directory traversal vulnerability was discovered in RepetierServer.exe in Repetier-Server 0.8 through 0.91 that allows for the creation of a user controlled XML file at an unintended location. When this is combined with CVE-2019-14451, an attacker can upload an "external command" configuration as a printer configuration, and achieve remote code execution. After exploitation, loading of the external command configuration is dependent on a system reboot or service restart.

Severity CVSS v4.0: Pending analysis

Last modification:

31/10/2019

CVE-2019-17181

Publication date:

28/10/2019

A remote SEH buffer overflow has been discovered in IntraSrv 1.0 (2007-06-03). An attacker may send a crafted HTTP GET or HEAD request that can result in a compromise of the hosting system.

Severity CVSS v4.0: Pending analysis

Last modification:

01/11/2019

CVE-2019-5536

Publication date:

28/10/2019

VMware ESXi (6.7 before ESXi670-201908101-SG and 6.5 before ESXi650-201910401-SG), Workstation (15.x before 15.5.0) and Fusion (11.x before 11.5.0) contain a denial-of-service vulnerability in the shader functionality. Successful exploitation of this issue may allow attackers with normal user privileges to create a denial-of-service condition on their own VM. Exploitation of this issue require an attacker to have access to a virtual machine with 3D graphics enabled. It is not enabled by default on ESXi and is enabled by default on Workstation and Fusion.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

Subscribe to Vulnerabilities